Web › Module 4 › Lesson 4
Security Misconfigurations
Default creds, verbose errors, open buckets, and debug endpoints—the low-hanging fruit attackers love
Visual · web_developer
Security misconfiguration is the gap between what you think you deployed and what is actually exposed—often worse in cloud and container setups.
Opening
The attack was “admin / admin”
Not every breach needs a zero-day. Often the panel was left on the public internet with factory defaults, debug mode printed stack traces with database URLs, or an S3 bucket was “public” because a template said so. Misconfiguration is OWASP A05 because it is common, easy to scan for, and devastating when combined with other flaws.
1. Typical Misconfiguration Hits
Default accounts
Tomcat manager, Jenkins, Grafana, router UI—unchanged passwords.
Verbose errors
Stack traces revealing paths, SQL, or secret names.
Open cloud storage
Public read on buckets with backups or PII.
Unneeded features
Directory listing, TRACE enabled, admin routes on prod.
2. Recon Commands (Authorized Targets)
Check response headers on your staging sitecurl -sI https://staging.yourdomain.example | grep -iE \\ "server:|x-powered-by:|access-control"
curl -sI https://staging.yourdomain.example | grep -iE \\ "server:|x-powered-by:|access-control"
Look for exposed admin paths in YOUR labffuf -u https://staging.yourdomain.example/FUZZ \\ -w /path/to/common.txt -mc 200,301,302 -t 20 # Only on hosts you own or have scope to test
ffuf -u https://staging.yourdomain.example/FUZZ \\ -w /path/to/common.txt -mc 200,301,302 -t 20 # Only on hosts you own or have scope to test
3. Hardening Checklist
• Remove default credentials and disable unused services • Separate dev/stage/prod; no debug in production • Automate config baselines (CIS benchmarks, IaC reviews) • Least privilege on cloud IAM and bucket policies • Patch management and inventory—you cannot secure what you do not know exists
Scan yourself first
Run misconfiguration checks against your own infrastructure before attackers do. Document findings and fix defaults before launch—not after a breach.
Knowledge Check
Security misconfiguration often includes:
Multiple choice
Knowledge Check
True or False: Verbose error pages in production can leak sensitive implementation details.
True or False
Knowledge Check
Public cloud storage buckets are risky because:
Multiple choice